samba - Mar 2024 - When accessing the User Properties only SIDs are shown instead of real name

Hi,

We have Windows 10, 11, Server 2012R2, 2016, 2019 and 2022 as members in 
our network. The issue happens randomly on different machines and 
different Windows OS. Find the smb.conf below.

# Global parameters [global] netbios name = PDC realm = XXXXXLTD.COM 
server role = active directory domain controller workgroup = KTKBANKLTD 
server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, 
winbindd, ntp_signd, kcc, dns, dnsupdate workgroup = XXXXLTD 
idmap_ldb:use rfc2307 = yes ldap server require strong auth = No allow 
dns updates = nonsecure tls priority = NORMAL:-VERS-TLS-ALL:+VERS-TLS1.2 
log level = 1 auth_audit:0 auth_json_audit:3 dsdb_json_audit:5 log file 
= /var/log/samba/pdc.log max log size = 1000000000 [sysvol] path = 
/usr/local/samba/var/locks/sysvol read only = No [netlogon] path = 
/usr/local/samba/var/locks/sysvol/ktkbankltd.com/scripts read only = No 
Let me know if you need additional information.

Thanks & Regards,

Anantha Raghava H A

DISCLAIMER:
This e-mail communication and any attachments may be privileged and 
confidential to Exza Technology Consulting & Services, Bangalore, and 
are intended only for the use of the recipients named above If you are 
not the addressee you may not copy, forward, disclose or use any part of 
it. If you have received this message in error, please delete it and all 
copies from your system and notify the sender immediately by return 
e-mail. Internet communications cannot be guaranteed to be timely, 
secure, error or virus-free. The sender does not accept liability for 
any errors or omissions.

Do not print this e-mail unless required. Save Paper & trees.


On 21/03/24 8:12 pm, Rowland Penny via samba wrote:
> On Thu, 21 Mar 2024 19:28:56 +0530
> Anantha Raghava via samba<samba at lists.samba.org>  wrote:
>
>> Hello,
>>
>> We are observing on some domain members we are observing, when we
>> open the user or group's properties, we are not seeing either the
>> real user names (Member Names) or group names instead only SIDs are
>> shown.
>>
>> Not able to figure out where the issue is.
> I don't think anyone else will be able to either, you haven't given
us
> anything to work with:
>
> What OS ?
> What is in the smb.conf ?
>
> Lets start from there.
>
> Rowland
>
>

On Thu, 21 Mar 2024 21:07:52 +0530
Anantha Raghava via samba <samba at lists.samba.org> wrote:
> Hi,
> 
> We have Windows 10, 11, Server 2012R2, 2016, 2019 and 2022 as members
> in our network. The issue happens randomly on different machines and 
> different Windows OS. Find the smb.conf below.
> 
> # Global parameters [global] netbios name = PDC realm = XXXXXLTD.COM 
> server role = active directory domain controller workgroup > KTKBANKLTD
server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc,
> drepl, winbindd, ntp_signd, kcc, dns, dnsupdate workgroup = XXXXLTD 
> idmap_ldb:use rfc2307 = yes ldap server require strong auth = No
> allow dns updates = nonsecure tls priority >
NORMAL:-VERS-TLS-ALL:+VERS-TLS1.2 log level = 1 auth_audit:0
> auth_json_audit:3 dsdb_json_audit:5 log file = /var/log/samba/pdc.log
> max log size = 1000000000 [sysvol] path >
/usr/local/samba/var/locks/sysvol read only = No [netlogon] path >
/usr/local/samba/var/locks/sysvol/ktkbankltd.com/scripts read only > No Let
me know if you need additional information.
> 
> Thanks & Regards,
> 
When I said 'What OS', I meant the OS that you are running the AD DC
on, not the clients.

If your DC is really called 'PDC' then can I point out it isn't a
PDC,
that is something else entirely.

If you are going to sanitise a smb.conf, then I suggest you sanitise
everything.

Is your dns domain really just 'ktkbankltd.com' ? 
If it is, is that dns domain reachable from the internet ?

Is there any pattern to the non mapped SIDs ?

Can I also point out that you appear to have 'workgroup' twice.

Rowland